5 ms·
I’m in the midst of a similar situation. My firstinitial.lastname email keeps getting very sensitive legal documents from law firms handling the case of someone
by baubino 1y ago
I’m in the midst of a similar situation. My firstinitial.lastname email keeps getting very sensitive legal documents from law firms handling the case of someone who does not seem to know what their actual email address is. I called the firm and told them they needed to have an in-person meeting with their client and get a correct email address from them. That seemed to help for a few months. But now I’m getting emails again from a different law firm.
- catoc 1y agoLaw firms that send very sensitive legal documents over email… #sigh I’d switch firms immediately if that’s their level of opsec awareness
- eru 1y agoWhat are you talking about? If you send emails from eg GMail to Gmail, it's fairly secure.
- catoc 1y agoEven if the law firm uses a Gmail account - which most of course don’t - Google still has access to your sensitive legal email content. (And that’s apart from the meta data leaking)
- basilgohar 1y agoGmail can be fetched via IMAP and leave Gmail's infra entirely. And I don't think Google guarantees that their implementation stays fully on their own owned infra. It's a reasonable assumption but I'd never trust that for a security guarantee. Email is not an end-to-end secure data protocol without the use of client side encryption/decryption like PGP/GPG, but even then, sender/receiver and time are all in the envelop metadata.
- catoc 1y agoYeah, that exactly my point - no idea why I’m being downvoted on this
- giancarlostoro 1y agoProbably because Law Firms arent necessarily computer security firms. Lots of people have terrible op sec. Additionally if you the recipient are on gmail it stops mattering, now Google knows your legal woes.
- catoc 1y agoExactly, I’d never use Gmail for anything sensitive. Even for just personal emails I use my own mailserver. (And again, for truly sensitive stuff I don’t use email at all)
- eru 1y agoIf the sender is using GMail, then using your own mail server is less secure than using GMail as the receiver.
- catoc 1y agoSure even though, as most others, my server supports TLS, having your email not leave gmail at all may be slightly more secure. Part of the point however was that when either server or receiver is using Gmail, your possibly confidential email content is still in Google’s hands. Using a personal server reduces that part of the attack surface. Still this does not mean I vacate my overall point that email in general is suboptimal from a secop standpoint.
- ArnoVW 1y agoif you attach documents by linking to a Google Drive document, sure. if you attach documents 'inside' the mail (i.e. MIME encoded multipart) that is most definitely not secure. 1) you do not know how that mail gets delivered, not necessarily via servers that support encryption 2) you do not know how that mail, or the attachment, gets stored on the local machine 3) you do now know if the mail, or attachment, is sent to someone else 4) you cannot revoke the access to the document once the Need To Known stops In our ISMS, sending Highly Sensitive data (ex: customer data) by attaching directly to a mail, is strictly not allowed by the IT charter. We explain it during an on-boarding meeting to all new staff members. And it's a fireable offense.
- dahart 1y agoWhy’s that even relevant if the recipient is the wrong address? Email isn’t particularly secure anywhere, and gmail has forwarding and IMAP and aliases and other services that send emails outside of gmail. But sending sensitive documents to the wrong recipient, which was the topic that started this sub-thread, is a case where it does not matter how secure your servers are.
- eru 1y ago> [...] and gmail has forwarding and IMAP and aliases and other services that send emails outside of gmail. No matter what format you hand a recipient a document in, they can always make a photocopy and pass it on.
- dahart 1y agoSure. How’s that relevant?
- eru 1y agoThat someone might use IMAP is no worse than someone using a photocopier.
- dahart 1y agoSure it is, and your own comment above about gmail to gmail being fairly secure demonstrated that. Using a photocopier is intentional, and everyone knows what a photocopier is. Most people don’t know what IMAP is, and an email sender does not know if the recipient uses IMAP. And this is still irrelevant to sending email to the wrong recipient, so I don’t know why you’re stuck on infra security.
- giancarlostoro 1y agoIf you reread again it sounds as if the secretary was hanging out the wrong email.
- catoc 1y agoYes I know this was about wrong delivery address (person with same name, wrong account); the point is that email is not completely secure - certainly not for very sensitive (legal) content
- stackskipton 1y agoAnd I worked IT for legal firm, if we were not sending documents over email, we would get replaced by the client. I spent 3 months on secure document transfer portal system, got scrapped after 4 months because clients wanted their forms as Word/PDF and they wanted them without hopping through any hoops.
- catoc 1y agoI believe you - convenience gets picked over security all the time